Superuser rights

[Leif Halvarsson_2]

Hi
Is it possible to give "Superuser righta" to a "ordinary" user.

[Pete Randall]

You can make there uid 0 in /etc/passwd - that makes them a root equivalent. A better approach might be to look into the sudo package.

Good luck,
Pete

[Bill Hassell]

Yes but with lots of warnings: don't change the user's UID to zero...major problems can occur. Don't give the user the root password unless they know as much as you do and always ask before making any changes.

Instead, get a copy of sudo from the Liverpool Archive:

http://hpux.connect.org.uk/

This program allows you (as root) to specify not only which users get superuser privileges but also which commands they can use and even which parameters are legal. For instance, you could allow many users to mount and umount a CDROM by specifying the mount command along with one devicefile. Any attempt to use the wrong commands or parameters will fail and logged.

[S.K. Chan]

I would consider using "sudo" if I were you.
http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.6/

[Bill McNAMARA_1]

you could also consider restricted sam

run
sam -r
as root and allocate permissions to groups/users.

Later,
Bill

[John Bolene]

Bill, what problems can happen with putting the uid to zero?

I have been operating that way for years with no problems that I know of.

[James R. Ferguson]

Hi Leif:

In the interest of "completeness", there is another classic approach, albeit frowned upon for security. That is to use a 'setuid' script to provide an ordinary user some special function.

You would create a Posix shell script with the shell interpreter specified:

#!/usr/bin/sh

If the name of the script were '/usr/local/bin/mysh' then, do:

# chown root:dba /usr/local/bin/mysh
# chmod 4110 /usr/local/bin/mysh

Users of the group 'dba' can now execute 'mysh' with the effective uid=0.

Notice that while they can execute the shell, they cannot read nor 'vi' it, thus providing a certain measure of security.

Regards!

...JRF...

[James R. Ferguson]

Hi John:

The "classic" error with having multiple uid=0 accounts is that you (or your successor) fail to notice that user 'john' has a uid=0, and proceed to remove 'john' from the server by name:

# find \ -user john -exec rm {} \;

...you just removed all files belonging to uid=0 (root's !!!)

[...time for an Ignite recovery ;-) ]

Regards!

...JRF...

[Victor_5]

Yes, sudo is a good idea. Another point is add the user name into every group, e.g. adm, bin, root and sys. You can get the similar permissions with root, but not exactly same with root.

[Shannon Petry]

John,

Besides what JRF pointed out there are numerous applications which will error from this as well.

Lets add the fact that a simple usermod can trash your OS.

Next
Because if it's easy use, most applications use your UID from getpwnum(). Of the remaining programs they will use the Name from getpwnam().
Rarely programs grab your full password entry getpwent().

I for one dont want to sit with developers on the phone trying to debug their apps when I have problems!

Regards,
Shannon

[Sanjay_6]

Hi Leif,

If the user id is set to 0, the user will have superuser rights on the system. To create such a user id, try,

useradd -u 0 -0 -g root -G root -d /user_home_dir -s /sbin/sh user_name

Hope this helps.

Regds

[Leif Halvarsson_2]

Hi
Thanks evrybody for your answers.
The security in ny case is no problem, this is not "real" users but application owners as "oracle", "dmadmin" etc. in fact it is the same person as root (I). This question is related to a question in another forum where I also get some answeres.
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x20d191ccb36bd611abdb0090277a778c,00.html